Every CVE Search/ Get API key

CVE-2026-45445

AES-OCB IV Ignored on EVP_Cipher() Path

7.5 HighFix available

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.70%Up 0.7 points since Jun 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

AES-OCB IV Ignored on EVP_Cipher() Path

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
CVE-2026-45445
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-325
Updated
2026-11-02
EUVDEUVD-2026-35489 7.5

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
EUVD-2026-35489
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-v446-xwfm-x7mr 7.5

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one...

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
GHSA-v446-xwfm-x7mr
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-325
Updated
2026-11-02
NVD 7.5

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
CVE-2026-45445
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-325
Updated
2026-11-02
OSVALPINE-CVE-2026-45445 7.5

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
ALPINE-CVE-2026-45445
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-45445 7.5
Record
BELL-CVE-2026-45445
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 42 moreShow less
OSV 7.5

AES-OCB IV Ignored on EVP_Cipher() Path

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
CVE-2026-45445
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-325
Updated
2026-11-02
OSVDEBIAN-CVE-2026-45445 7.5

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message. OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV. If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair. The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
DEBIAN-CVE-2026-45445
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVJLSEC-2026-1143 7.5

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one...

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
JLSEC-2026-1143
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-2772 9.1

edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.

Security Fix(es):

EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability will lead to

possible information disclosure or escalation of privilege

and impact Confidentiality.(CVE-2024-38798)

EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2025-2295)

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms.

Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated.

An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer.

Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-34180)

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises.

Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message.

In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message.

An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success.

If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message.

In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content.

The FIPS modules are not affected by this issue.(CVE-2026-34182)

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied…

Record
OESA-2026-2772
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2781 9.1

openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Security Fix(es):

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms.

Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated.

An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer.

Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-34180)

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises.

Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message.

In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message.

An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success.

If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message.

In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content.

The FIPS modules are not affected by this issue.(CVE-2026-34182)

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption.

Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service.

The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present.

An attacker who supplies such a CMS message to an application performing password-based CMS decryption…

Record
OESA-2026-2781
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2875 7.5

edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.

Security Fix(es):

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.(CVE-2026-45445)

Record
OESA-2026-2875
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:25237 9.1

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:25237
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:25239 9.1

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:25239
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:42825 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:42825
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:55543 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:55543
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:59635 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:59635
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:59641 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:59641
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62562 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:62562
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62563 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:62563
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62790 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:62790
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67551 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:67551
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:71542 9.1

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:71542
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:83617 9.1

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:83617
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:84572 9.1

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:84572
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:84573 9.1

Red Hat Security Advisory: openssl security update

Record
RHSA-2026:84573
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:25237 9.1

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)

  • openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)

  • openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)

  • openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)

  • openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)

  • openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)

  • openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)

  • openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)

  • openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)

  • openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)

  • openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)

  • openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)

  • openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)

  • openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)

  • openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25237
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:25239 9.1

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)

  • openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)

  • openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)

  • openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)

  • openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)

  • openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)

  • openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)

  • openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)

  • openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)

  • openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)

  • openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)

  • openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)

  • openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)

  • openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)

  • openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25239
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-45445 7.5

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message. OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV. If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair. The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
UBUNTU-CVE-2026-45445
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:25237 No score

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)
  • openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)
  • openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)
  • openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)
  • openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)
  • openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)
  • openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)
  • openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)
  • openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)
  • openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)
  • openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)
  • openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)
  • openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)
  • openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)
  • openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25237
Updated
2026-11-02
OSVALSA-2026:25239 No score

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383)
  • openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076)
  • openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180)
  • openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)
  • openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)
  • openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)
  • openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)
  • openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)
  • openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)
  • openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)
  • openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)
  • openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)
  • openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)
  • openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)
  • openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:25239
Updated
2026-11-02
OSVAZL-89793 No score

CVE-2026-45445 affecting package openssl-fips-provider 3.1.2-2

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
AZL-89793
Updated
2026-11-05
OSVAZL-89876 No score

CVE-2026-45445 affecting package edk2 for versions less than 20240524git3e722403cd16-18

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
AZL-89876
Updated
2026-11-05
OSVAZL-90087 No score

CVE-2026-45445 affecting package openssl for versions less than 3.3.7-3

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Record
AZL-90087
Updated
2026-11-05
OSVCLSA-2026-1782152259 No score

openssl: Fix of 5 CVEs

  • CVE-2026-45445: AES-OCB IV ignored on EVP_Cipher() path
Record
CLSA-2026-1782152259
Updated
2026-11-02
OSVMGASA-2026-0253 No score

Updated openssl packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion. (CVE-2026-7383) Out-of-Bounds Read in CMS Password-Based Decryption. (CVE-2026-9076) Heap Buffer Over-read in ASN.1 Content Parsing. (CVE-2026-34180) PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys. (CVE-2026-34181) CMS AuthEnvelopedData Processing May Accept Forged Messages. (CVE-2026-34182) Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler. (CVE-2026-34183) NULL Pointer Dereference in QUIC Server Initial Packet Handling. (CVE-2026-42764) Possible NULL Dereference in Password-Based CMS Decryption. (CVE-2026-42766) NULL Pointer Dereference in CRMF EncryptedValue Decryption. (CVE-2026-42767) Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt(). (CVE-2026-42768) Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate. (CVE-2026-42769) FFC-DH Peer Validation Uses Attacker-Supplied q. (CVE-2026-42770) AES-OCB IV Ignored on EVP_Cipher() Path. (CVE-2026-45445) Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446) Heap Use-After-Free in the PKCS7_verify(). (CVE-2026-45447)

Record
MGASA-2026-0253
Updated
2026-11-02
OSVOESA-2026-2651 No score

openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Security Fix(es):

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.(CVE-2026-45445)

Record
OESA-2026-2651
Updated
2026-11-02
OSVopenSUSE-SU-2026:11023-1 No score

libopenssl-3-devel-3.5.3-6.1 on GA media

These are all security issues fixed in the libopenssl-3-devel-3.5.3-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11023-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21005-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
  • CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
  • CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
  • CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
  • CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
openSUSE-SU-2026:21005-1
Updated
2026-11-02
OSVROOT-OS-ALPINE-317-CVE-2026-45445 No score

CVE-2026-45445 in openssl - Patched by Root

Root has patched CVE-2026-45445 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-317-CVE-2026-45445
Updated
2026-11-02
OSVSUSE-SU-2026:22100-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:22100-1
Updated
2026-11-02
OSVSUSE-SU-2026:22132-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2024-41996: DHEATATTACK: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE (bsc#1230698).
  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:22132-1
Updated
2026-11-02
OSVSUSE-SU-2026:22251-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
  • CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
  • CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
  • CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
  • CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:22251-1
Updated
2026-11-02
OSVSUSE-SU-2026:22315-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
  • CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
  • CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
  • CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
  • CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:22315-1
Updated
2026-11-02
OSVSUSE-SU-2026:2393-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:2393-1
Updated
2026-11-02
OSVSUSE-SU-2026:2397-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:2397-1
Updated
2026-11-02
OSVSUSE-SU-2026:2598-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:2598-1
Updated
2026-11-02
OSVSUSE-SU-2026:2648-1 No score

Security update for openssl-3

This update for openssl-3 fixes the following issues

  • CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
  • CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
  • CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
  • CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (bsc#1266343).
  • CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
  • CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
  • CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
  • CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
  • CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
  • CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
  • CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
  • CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
  • CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
Record
SUSE-SU-2026:2648-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Alpine:v3.21
 3.0.0 up to 3.3.7-r1
3.3.7-r1
openssl
Alpine:v3.22
 3.0.0 up to 3.5.7-r0
3.5.7-r0
openssl
Alpine:v3.23
 3.0.0 up to 3.5.7-r0
3.5.7-r0
openssl
Alpine:v3.24
 3.0.0 up to 3.5.7-r0
3.5.7-r0
openssl
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2.alma.1
1:3.5.5-4.el10_2.alma.1
openssl-devel
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2.alma.1
1:3.5.5-4.el10_2.alma.1
openssl-libs
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2.alma.1
1:3.5.5-4.el10_2.alma.1
openssl-perl
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2.alma.1
1:3.5.5-4.el10_2.alma.1
openssl
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-devel
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
Show 182 moreShow less
Affected packages
PackageAffectedFixed
openssl-libs
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-perl
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-fips-provider
Azure Linux:3
 through 3.1.2-2 None known
edk2
Azure Linux:3
 before 20240524git3e722403cd16-18
20240524git3e722403cd16-18
openssl
Azure Linux:3
 before 3.3.7-3
3.3.7-3
openssl
Alpaquita:23
 3.0.8-r4 up to 3.0.21-r0
3.0.21-r0
openssl
Alpaquita:25
 3.5.0-r0 up to 3.5.7-r0
3.5.7-r0
openssl
Alpaquita:stream
 3.1.1-r1 up to 3.5.7-r0
3.5.7-r0
openssl
BellSoft Hardened Containers:23
 3.0.8-r4 up to 3.0.21-r0
3.0.21-r0
openssl
BellSoft Hardened Containers:25
 3.5.0-r0 up to 3.5.7-r0
3.5.7-r0
openssl
BellSoft Hardened Containers:stream
 3.1.1-r1 up to 3.5.7-r0
3.5.7-r0
openssl
TuxCare:AlmaLinux:9.2
 before 1:3.0.7-20.el9_2.tuxcare.1.els18
1:3.0.7-20.el9_2.tuxcare.1.els18
openssl-devel
TuxCare:AlmaLinux:9.2
 before 1:3.0.7-20.el9_2.tuxcare.1.els18
1:3.0.7-20.el9_2.tuxcare.1.els18
openssl-libs
TuxCare:AlmaLinux:9.2
 before 1:3.0.7-20.el9_2.tuxcare.1.els18
1:3.0.7-20.el9_2.tuxcare.1.els18
openssl-perl
TuxCare:AlmaLinux:9.2
 before 1:3.0.7-20.el9_2.tuxcare.1.els18
1:3.0.7-20.el9_2.tuxcare.1.els18
openssl
Debian:12
 before 3.0.20-1~deb12u2, plus listed versions
3.0.10-13.0.10-1~deb12u13.0.11-13.0.11-1~deb12u13.0.11-1~deb12u2
Show 17 moreShow less
3.0.12-13.0.12-23.0.13-1~deb12u13.0.13-1~deb12u23.0.14-1~deb12u13.0.14-1~deb12u23.0.15-1~deb12u13.0.16-1~deb12u13.0.17-1~deb12u13.0.17-1~deb12u23.0.17-1~deb12u33.0.18-1~deb12u13.0.18-1~deb12u23.0.19-1~deb12u13.0.19-1~deb12u23.0.20-1~deb12u13.0.9-1
3.0.20-1~deb12u2
openssl
Debian:13
 before 3.5.6-1~deb13u2, plus listed versions
3.5.1-13.5.1-1+deb13u13.5.2-13.5.3-13.5.4-1
Show 6 moreShow less
3.5.4-1~deb13u13.5.4-1~deb13u23.5.5-13.5.5-1~deb13u13.5.5-1~deb13u23.5.6-1~deb13u1
3.5.6-1~deb13u2
openssl
Debian:14
 before 3.6.3-1, plus listed versions
3.5.1-13.5.2-13.5.3-13.5.4-13.5.4-1~deb13u1
Show 17 moreShow less
3.5.4-1~deb13u23.5.5-13.5.5-1~deb13u13.5.5-1~deb13u23.5.6-1~deb13u13.5.6-1~deb13u23.5.7-1~deb13u13.5.7-1~deb13u23.5.7-1~deb13u33.6.0-13.6.0-23.6.0~~alpha1-13.6.0~~beta1-13.6.1-13.6.1-23.6.1-33.6.2-1
3.6.3-1
AppBundler
Julia
 1.0.0 up to 1.0.1
1.0.1
OpenSSL_jll
Julia
 3.0.8+0 up to 3.5.7+0
3.5.7+0
Openresty_jll
Julia
 1.27.1+0 and later None known
openssl
Mageia:10
From an advisory covering 15 CVEs
 before 3.5.7-1.mga10
3.5.7-1.mga10
openssl
Mageia:9
From an advisory covering 15 CVEs
 before 3.0.21-1.mga9
3.0.21-1.mga9
openssl
openEuler:24.03-LTS-SP3
 before 3.0.12-50.oe2403sp3
3.0.12-50.oe2403sp3
edk2
openEuler:24.03-LTS-SP1
From an advisory covering 7 CVEs
 before 202308-37.oe2403sp1
202308-37.oe2403sp1
openssl
openEuler:24.03-LTS-SP1
From an advisory covering 10 CVEs
 before 3.0.12-52.oe2403sp1
3.0.12-52.oe2403sp1
edk2
openEuler:24.03-LTS-SP3
 before 202308-42.oe2403sp3
202308-42.oe2403sp3
openssl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-perl
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-perl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl
Red Hat:enterprise_linux:9::baseos
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-libs
Red Hat:enterprise_linux:9::baseos
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl-libs-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
chunkah
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:0.6.0-3.hum1
0:0.6.0-3.hum1
python-cryptography
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:50.0.0-1.hum1
0:50.0.0-1.hum1
python3-cryptography
Red Hat:hummingbird:1
From an advisory covering 24 CVEs
 before 0:50.0.0-1.hum1
0:50.0.0-1.hum1
openssl3
Red Hat:hummingbird:1
From an advisory covering 27 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl3-devel
Red Hat:hummingbird:1
From an advisory covering 27 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl3-devel-engine
Red Hat:hummingbird:1
From an advisory covering 27 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl3-libs
Red Hat:hummingbird:1
From an advisory covering 27 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-config-fips
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-devel
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-devel-engine
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-fips-provider-upstream
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-libs
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
openssl-perl
Red Hat:hummingbird:1
From an advisory covering 28 CVEs
 before 0:3.5.8-0.1.hum1
0:3.5.8-0.1.hum1
ruby3.3
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
ruby3.3-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
ruby3.3-default-gems
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
ruby3.3-devel
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
ruby3.3-doc
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
ruby3.3-libs
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.3.10-23.6.hum1
0:3.3.10-23.6.hum1
rubygem3.3-bigdecimal
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.1.5-23.6.hum1
0:3.1.5-23.6.hum1
rubygem3.3-bundler
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:2.5.22-23.6.hum1
0:2.5.22-23.6.hum1
rubygem3.3-devel
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.5.22-23.6.hum1
0:3.5.22-23.6.hum1
rubygem3.3-io-console
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:0.7.1-23.6.hum1
0:0.7.1-23.6.hum1
rubygem3.3-irb
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:1.13.1-23.6.hum1
0:1.13.1-23.6.hum1
rubygem3.3-json
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:2.7.2-23.6.hum1
0:2.7.2-23.6.hum1
rubygem3.3-minitest
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:5.20.0-23.6.hum1
0:5.20.0-23.6.hum1
rubygem3.3-power_assert
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:2.0.3-23.6.hum1
0:2.0.3-23.6.hum1
rubygem3.3-psych
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:5.1.2-23.6.hum1
0:5.1.2-23.6.hum1
rubygem3.3-racc
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:1.7.3-23.6.hum1
0:1.7.3-23.6.hum1
rubygem3.3-rake
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:13.1.0-23.6.hum1
0:13.1.0-23.6.hum1
rubygem3.3-rbs
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.4.0-23.6.hum1
0:3.4.0-23.6.hum1
rubygem3.3-rdoc
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:6.6.3.1-23.6.hum1
0:6.6.3.1-23.6.hum1
rubygem3.3-rexml
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.4.4-23.6.hum1
0:3.4.4-23.6.hum1
rubygem3.3-rss
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:0.3.1-23.6.hum1
0:0.3.1-23.6.hum1
rubygem3.3-rubygems
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.5.22-23.6.hum1
0:3.5.22-23.6.hum1
rubygem3.3-test-unit
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:3.6.1-23.6.hum1
0:3.6.1-23.6.hum1
rubygem3.3-typeprof
Red Hat:hummingbird:1
From an advisory covering 22 CVEs
 before 0:0.21.9-23.6.hum1
0:0.21.9-23.6.hum1
ruby4.0
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
ruby4.0-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
ruby4.0-default-gems
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
ruby4.0-devel
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
ruby4.0-doc
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
ruby4.0-libs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.6-37.3.hum1
0:4.0.6-37.3.hum1
rubygem4.0-bigdecimal
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.1-37.3.hum1
0:4.0.1-37.3.hum1
rubygem4.0-bundler
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.16-37.3.hum1
0:4.0.16-37.3.hum1
rubygem4.0-devel
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.16-37.3.hum1
0:4.0.16-37.3.hum1
rubygem4.0-io-console
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:0.8.2-37.3.hum1
0:0.8.2-37.3.hum1
rubygem4.0-irb
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:1.16.0-37.3.hum1
0:1.16.0-37.3.hum1
rubygem4.0-json
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:2.18.0-37.3.hum1
0:2.18.0-37.3.hum1
rubygem4.0-minitest
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:6.0.0-37.3.hum1
0:6.0.0-37.3.hum1
rubygem4.0-power_assert
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:3.0.1-37.3.hum1
0:3.0.1-37.3.hum1
rubygem4.0-psych
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:5.3.1-37.3.hum1
0:5.3.1-37.3.hum1
rubygem4.0-racc
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:1.8.1-37.3.hum1
0:1.8.1-37.3.hum1
rubygem4.0-rake
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:13.3.1-37.3.hum1
0:13.3.1-37.3.hum1
rubygem4.0-rbs
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:3.10.0-37.3.hum1
0:3.10.0-37.3.hum1
rubygem4.0-rdoc
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:7.0.4-37.3.hum1
0:7.0.4-37.3.hum1
rubygem4.0-rexml
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:3.4.4-37.3.hum1
0:3.4.4-37.3.hum1
rubygem4.0-rss
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:0.3.2-37.3.hum1
0:0.3.2-37.3.hum1
rubygem4.0-rubygems
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:4.0.16-37.3.hum1
0:4.0.16-37.3.hum1
rubygem4.0-test-unit
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:3.7.5-37.3.hum1
0:3.7.5-37.3.hum1
rubygem4.0-typeprof
Red Hat:hummingbird:1
From an advisory covering 21 CVEs
 before 0:0.31.1-37.3.hum1
0:0.31.1-37.3.hum1
ruby3.4
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
ruby3.4-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
ruby3.4-default-gems
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
ruby3.4-devel
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
ruby3.4-doc
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
ruby3.4-libs
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:3.4.10-31.7.hum1
0:3.4.10-31.7.hum1
bootupd
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:0.3.2-1.hum1
0:0.3.2-1.hum1
rust-bootupd
Red Hat:hummingbird:1
From an advisory covering 19 CVEs
 before 0:0.3.2-1.hum1
0:0.3.2-1.hum1
openssl-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl-perl
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:3.2.2-16.el10_0.7
1:3.2.2-16.el10_0.7
openssl-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-perl
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-debuginfo
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-debugsource
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-libs
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 7 CVEs
 before 1:3.2.2-7.el9_6.4
1:3.2.2-7.el9_6.4
openssl-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 6 CVEs
 before 1:3.0.7-18.el9_2.4
1:3.0.7-18.el9_2.4
openssl-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 6 CVEs
 before 1:3.0.7-18.el9_2.4
1:3.0.7-18.el9_2.4
openssl
Red Hat:rhel_e4s:9.2::baseos
From an advisory covering 6 CVEs
 before 1:3.0.7-18.el9_2.4
1:3.0.7-18.el9_2.4
openssl-debuginfo
Red Hat:rhel_e4s:9.2::baseos
From an advisory covering 6 CVEs
 before 1:3.0.7-18.el9_2.4
1:3.0.7-18.el9_2.4
openssl-debugsource
Red Hat:rhel_e4s:9.2::baseos
From an advisory covering 6 CVEs
 before 1:3.0.7-18.el9_2.4
1:3.0.7-18.el9_2.4
openssl-libs
Red Hat:rhel_e4s:9.2::baseos
From an advisory covering 6 CVEs
 before 1:3.0.7-18.el9_2.4
1:3.0.7-18.el9_2.4
openssl-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 6 CVEs
 before 1:3.0.7-29.el9_4.3
1:3.0.7-29.el9_4.3
openssl-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 6 CVEs
 before 1:3.0.7-29.el9_4.3
1:3.0.7-29.el9_4.3
openssl-libs-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 6 CVEs
 before 1:3.0.7-29.el9_4.3
1:3.0.7-29.el9_4.3
openssl
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 6 CVEs
 before 1:3.0.7-29.el9_4.3
1:3.0.7-29.el9_4.3
openssl-debuginfo
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 6 CVEs
 before 1:3.0.7-29.el9_4.3
1:3.0.7-29.el9_4.3
openssl-debugsource
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 6 CVEs
 before 1:3.0.7-29.el9_4.3
1:3.0.7-29.el9_4.3
openssl-libs
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 6 CVEs
 before 1:3.0.7-29.el9_4.3
1:3.0.7-29.el9_4.3
openssl-libs-debuginfo
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 6 CVEs
 before 1:3.0.7-29.el9_4.3
1:3.0.7-29.el9_4.3
openssl
Rocky Linux:10
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el10_2
1:3.5.5-4.el10_2
openssl
Rocky Linux:9
From an advisory covering 15 CVEs
 before 1:3.5.5-4.el9_8
1:3.5.5-4.el9_8
openssl
Root:Alpine:3.17
 before 3.0.19-r00079
3.0.19-r000793.0.19-r000773.0.19-r00078
rootio-openssl
Root:Alpine:3.17
 before 3.0.19-r00079
3.0.19-r000793.0.19-r000773.0.19-r00078
openssl-3
SUSE:Linux Micro 6.0
From an advisory covering 9 CVEs
 before 3.1.4-14.1
3.1.4-14.1
openssl-3
SUSE:Linux Micro 6.1
From an advisory covering 11 CVEs
 before 3.1.4-slfo.1.1_10.1
3.1.4-slfo.1.1_10.1
openssl-3
SUSE:Linux Micro 6.2
From an advisory covering 15 CVEs
 before 3.5.0-160000.8.1
3.5.0-160000.8.1
openssl-3
SUSE:Linux Enterprise Server 16.0
From an advisory covering 15 CVEs
 before 3.5.0-160000.8.1
3.5.0-160000.8.1
openssl-3
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 15 CVEs
 before 3.5.0-160000.8.1
3.5.0-160000.8.1
openssl-3
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 9 CVEs
 before 3.1.4-150600.5.53.1
3.1.4-150600.5.53.1
openssl-3
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 9 CVEs
 before 3.1.4-150600.5.53.1
3.1.4-150600.5.53.1
openssl-3
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 8 CVEs
 before 3.0.8-150500.5.66.1
3.0.8-150500.5.66.1
openssl-3
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 3.0.8-150500.5.66.1
3.0.8-150500.5.66.1
openssl-3
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 3.0.8-150500.5.66.1
3.0.8-150500.5.66.1
openssl-3
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 8 CVEs
 before 3.0.8-150500.5.66.1
3.0.8-150500.5.66.1
openssl-3
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 8 CVEs
 before 3.0.8-150400.4.87.1
3.0.8-150400.4.87.1
openssl-3
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 8 CVEs
 before 3.0.8-150400.4.87.1
3.0.8-150400.4.87.1
openssl-3
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 8 CVEs
 before 3.0.8-150400.4.87.1
3.0.8-150400.4.87.1
openssl-3
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 3.0.8-150400.4.87.1
3.0.8-150400.4.87.1
openssl-3
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 3.0.8-150400.4.87.1
3.0.8-150400.4.87.1
openssl-3
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 8 CVEs
 before 3.0.8-150400.4.87.1
3.0.8-150400.4.87.1
openssl-3
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 13 CVEs
 before 3.2.3-150700.5.36.1
3.2.3-150700.5.36.1
openssl
Ubuntu:22.04:LTS
 before 3.0.2-0ubuntu1.25, plus listed versions
1.1.1l-1ubuntu13.0.0-1ubuntu13.0.1-0ubuntu13.0.2-0ubuntu13.0.2-0ubuntu1.1
Show 19 moreShow less
3.0.2-0ubuntu1.23.0.2-0ubuntu1.43.0.2-0ubuntu1.53.0.2-0ubuntu1.63.0.2-0ubuntu1.73.0.2-0ubuntu1.83.0.2-0ubuntu1.93.0.2-0ubuntu1.103.0.2-0ubuntu1.123.0.2-0ubuntu1.133.0.2-0ubuntu1.143.0.2-0ubuntu1.153.0.2-0ubuntu1.163.0.2-0ubuntu1.173.0.2-0ubuntu1.183.0.2-0ubuntu1.193.0.2-0ubuntu1.203.0.2-0ubuntu1.213.0.2-0ubuntu1.23
3.0.2-0ubuntu1.25
nodejs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3
Show 7 moreShow less
12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.412.22.9~dfsg-1ubuntu3.512.22.9~dfsg-1ubuntu3.612.22.9~dfsg-1ubuntu3.6+esm2
 None known
openssl
Ubuntu:Pro:FIPS-preview:22.04:LTS
 All versions, plus listed versions
3.0.2-0ubuntu1.10+Fips13.0.2-0ubuntu1.12+Fips1
 None known
openssl-fips
Ubuntu:Pro:FIPS-preview:22.04:LTS
 All versions, plus listed versions
3.0.5-0ubuntu0.1+Fips2.1
 None known
openssl
Ubuntu:Pro:FIPS-updates:22.04:LTS
 before 3.0.2-0ubuntu1.25+Fips1, plus listed versions
3.0.2-0ubuntu1.10+Fips13.0.2-0ubuntu1.12+Fips13.0.2-0ubuntu1.14+Fips13.0.2-0ubuntu1.15+Fips13.0.2-0ubuntu1.16+Fips1
Show 6 moreShow less
3.0.2-0ubuntu1.17+Fips13.0.2-0ubuntu1.18+Fips13.0.2-0ubuntu1.19+Fips13.0.2-0ubuntu1.20+Fips13.0.2-0ubuntu1.21+Fips13.0.2-0ubuntu1.23+Fips1
3.0.2-0ubuntu1.25+Fips1
openssl-fips
Ubuntu:Pro:FIPS-updates:22.04:LTS
 All versions, plus listed versions
3.0.5-0ubuntu0.1+Fips2.13.0.5-0ubuntu0.2+Fips1
 None known
edk2
Ubuntu:24.04:LTS
 All versions, plus listed versions
2023.05-22023.11-22023.11-32023.11-42023.11-5
Show 13 moreShow less
2023.11-62023.11-82024.02-12024.02-22024.02-2ubuntu0.12024.02-2ubuntu0.32024.02-2ubuntu0.42024.02-2ubuntu0.52024.02-2ubuntu0.62024.02-2ubuntu0.72024.02-2ubuntu0.82024.02-2ubuntu0.92024.02-2ubuntu0.10
 None known
openssl
Ubuntu:24.04:LTS
 before 3.0.13-0ubuntu3.11, plus listed versions
3.0.10-1ubuntu23.0.10-1ubuntu2.13.0.10-1ubuntu33.0.10-1ubuntu43.0.13-0ubuntu2
Show 9 moreShow less
3.0.13-0ubuntu33.0.13-0ubuntu3.13.0.13-0ubuntu3.23.0.13-0ubuntu3.33.0.13-0ubuntu3.43.0.13-0ubuntu3.53.0.13-0ubuntu3.63.0.13-0ubuntu3.73.0.13-0ubuntu3.9
3.0.13-0ubuntu3.11
openssl-fips
Ubuntu:Pro:FIPS-updates:24.04:LTS
 before 3.0.13-0ubuntu3.12+Fips1, plus listed versions
3.0.13-0ubuntu3+Fips13.0.13-0ubuntu3.6+Fips1
3.0.13-0ubuntu3.12+Fips1
edk2
Ubuntu:25.10
 All versions, plus listed versions
2025.02-3ubuntu22025.02-82025.02-8ubuntu12025.02-8ubuntu22025.02-8ubuntu32025.02-8ubuntu3.12025.02-8ubuntu3.2
 None known
openssl
Ubuntu:25.10
 before 3.5.3-1ubuntu3.4, plus listed versions
3.4.1-1ubuntu33.5.0-2ubuntu13.5.2-1ubuntu13.5.3-1ubuntu23.5.3-1ubuntu33.5.3-1ubuntu3.3
3.5.3-1ubuntu3.4
edk2
Ubuntu:26.10
 All versions, plus listed versions
2025.11-3ubuntu72025.11-3ubuntu82026.05-2ubuntu12026.05-2ubuntu22026.05-2ubuntu3
 None known
edk2-hwe
Ubuntu:26.10
 All versions, plus listed versions
2025.11-3ubuntu82025.11-3ubuntu92026.05-2ubuntu12026.05-2ubuntu22026.05-2ubuntu3
 None known
edk2
Ubuntu:26.04:LTS
 All versions, plus listed versions
2025.02-8ubuntu32025.11-3ubuntu62025.11-3ubuntu72025.11-3ubuntu7.22025.11-3ubuntu7.3
 None known
edk2-hwe
Ubuntu:26.04:LTS
 All versions, plus listed versions
2025.11-3ubuntu62025.11-3ubuntu82025.11-3ubuntu8.2
 None known
openssl
Ubuntu:26.04:LTS
 before 3.5.5-1ubuntu3.2, plus listed versions
3.5.3-1ubuntu23.5.5-1ubuntu13.5.5-1ubuntu3
3.5.5-1ubuntu3.2
openssl-3
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 3.5.3-6.1
3.5.3-6.1
openssl-3
openSUSE:Leap 16.0
From an advisory covering 15 CVEs
 before 3.5.0-160000.8.1
3.5.0-160000.8.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-45445 is a high vulnerability (CVSS 7.5) in Openssl, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in openssl 3.3.7-r1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 113 references and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open